Re: [Doh] [DNSOP] New I-D: draft-reid-doh-operator

["Martin Thomson" <[e-mail]>]

I agree with Ted.

On Wed, Mar 20, 2019, at 04:46, Ted Hardie wrote:
> My apologies if I have misunderstood your point 
> here, but unless you also block all traffic for which you have seen no 
> resolution event, I believe that it is entirely possible to circumvent 
> the defense you describe.

The problem with blocking packets that can't be traced to a resolution event is that you need to catch all the resolution events. DNS doesn't have a monopoly on address resolution - I mean, that's the whole point of this discussion, isn't it?

Yes, there are a great many protocols that include a DNS query before every communication attempt, but not all.  If you are comfortable breaking or degrading all the other protocols, this is I guess an OK strategy.  I personally wouldn't call the thing that you get out the other end "Internet".  Of course, people routinely make that claim with only TCP ports 80 and 443 open.

> browsers treated all downloaded 
> JavaScript applications as potentially malign. 

Nicely understated.  Spend any amount of time on this problem and the word "potentially" just fades away.